STATE OF MICHIGAN 
67TH DISTRICT COURT 


SEARCH WARRANT 


CASE NO. 2019 Flint Water Crisis 
POLICE AGENCY Department of 
Attorney General 
REPORT NO. 2019-FWCT 


TO THE SHERIFF OR ANY PEACE OFFICER: 


A. PERSON, PLACE, or THING to be searched is described as and located 
at: 

The Department of Attorney General, State Operations Division, 

525 West Ottawa, 

G. Mennen Williams Bldg., Lansing, MI 48909 

B. PROPERTY to be searched for and seized, if found, is specifically 
described as: 

1. All unredacted State of Michigan (SOM) Data related to the Flint Water Crisis 
Investigation (FWCI) that is stored at premises owned, maintained, controlled, 
leased, rented, or operated by the Service Provider, KLDiscoveiy. The Service 
Provider, KLDiscoveiy is required to disclose the following information to the 
State of Michigan Solicitor General or a member of the Flint Water Crisis 
Investigation Team: 

2, All original information, data, or files, whether electronic or paper, that were 
provided to the Service Provider, KLDiscoveiy, by any State of Michigan 
representative for potential inclusion in either of the workspaces described above. 


3. All SOM Data and all associated available metadata, including metadata 
described in Appendix A, if available. The SOM Data including both source native 
files and images, plus associated metadata is to be provided in the industry 
standard Concordance format of .dat and .opt, also known as a Relativity Load 
File. 
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4. All necessary information in order to install the Relativity Load File into a new 
Relativity workspace, including but not limited to usernames, passwords, Load 
File field descriptions, etc. will be seized at the time the warrant is executed. 


IN THE NAME OF THE PEOPLE OF THE STATE OF MICHIGAN: I have found that probable 
cause exists, and you are commanded to make the search and seize the described property. Leave a 
copy of tilts warrant with attached tabulation (a written inventory) of all property taken with the 
person from whom the property was taken or at the premises. You are further commanded to 
promptly return this warrant and tabulation to the Court. 
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EXHIBIT A - TYPES OF METADATA 


Field Name 

Example 

Description 

BEGDOC 

EDC00000001 

Unique beginning number for 
each record. 

ENDDOC 

EDC00000002 

Unique ending number for 
each record. 

ATTACHRANGE 

EDC00000001-EDC00000008 

includes the BEGDOC of the 
parent record and the 
ENDDOC of the last 
attachment record, separated 
by a hyphen 

BEGATTACH 

EDCOOOOOOOl 

The unique BEGDOC number 
for the first attached record. 

ENDATTACH 

EDC00000008 

The unique ENDDOC number 
for the last attached record. 

ATTACH 

Attachi.doc; Attacl12.xls 

For parent records - lists the 
original filenames of all 
attached records, separated 
by the multi-value delimiter. 

NUMATTACH 

2 

For parent records - total 
number of records attached. 

ATTACHMT 

EDCooooooo2;EDCooooooo3 

For parent records - lists of 
BEGDOC numbers for all 
attached records, separated 
by the multi-value delimiter. 

MD5HASH 

D564668821C34200FF3E32C9BF 

DCCC80 

Unique MD5 hash value for 
the record. 

CUSTODIAN 

Smith, John 

Person from whom the 
document originated or the 
place/system from where the 
document was collected. 

ALTCUSTODIAN 

Joe Wilson; Bob Smith; John Doe 

List of custodians where the 
record has been removed as a 
duplicate of the one being 
produced. 

RECORDTYPE 

LOOSE E-MAIL 

Phe type of document, such 
as, Image, E-Mail, Loose E- 
Mail, Attachment, eDoc, etc. 

APPLICATIONNAME 

MICROSOFT OFFICE WORD 

Native application used to 
access file, pulled from 
metadata of the native file. 

























DOCEXT 

XLS 

The original file extension of 
the record. 

FILENAME 

Estimates.xls 

-or- 

FW: Monday Meeting 

For native files: The original 
file name of a native file 

For Email records: Subject of 
e-mail message 

FILESIZE 

27739 

Size of the original native file, 
in bytes. 

AUTHOR 

John Smith 

Author field from the 
metadata of the native file. 

EDSOURCE 

C: \Mail\Outloolc.pst 
-or- 

C: \Docmnents\Financials 

Fully qualified original path 
to the source folder, files 
and/or mail stores 

EDFOLDER 


For native files: full path to 
source file 

For email records: folder path 
contained within the mail 
store 

LASTAUTHOR 

Joe L. Smith 

Last save by author from 
metadata of the native file. 

DATESENT 

10/12/2010 

Sent date of an email 
message. 

DATERCVD 

05/22/2011 

Received date of an email 
message. 

DATECREATED 

09/18/2010 

Creation date of a native file. 

DATELASTMOD 

02/11/2012 

Date the native file was last 
modified. 

DATEACCESSED 

11/23/2010 

Date the native file was last 
accessed. 

DATELASTPRNT 

02/13/2011 

Date the native file was last 
printed. 

DATEAPPSTART 

03/05/2012 

Appointment start date for 
calendar items. 

DATEAPPEND 

03/05/2012 

Appointment end date for 
calendar items. 

TIMESENT 

07:05:12 

Sent time of an email 
message. 

TIMERCVD 

10:22:54 

Received time of an email 
message. 

TIMECREATED 

02:45:23 

Creation time of a native file. 


























TIMELASTMOD 

35:12:14 

Time the native file was last 
modified. 

TIMEACCESSED 

11:12:43 

Time the native file was last 
accessed. 

TIMELASTPRNT 

10:34:12 

Time the native file was last 
printed. 

TIMEAPPSTART 

38:00:00 

Appointment start time for 
calendar items. 

TIMEAPPEND 

39:00:23 

Appointment end time for 
calendar items. 

TIMEZONEPROC 

(GMT -05:00) Eastern Time 

Time zone where record was 
first processed 

FROM 

Jane Smith 

Author of email message. 

TO 

Smith, Jane; LeeW [mailto: 
LeeW@gmail.com] 

Main recipient(s) of email 
message. 

CC 

John Paul [mailto: 

ohn_paul@gmail.com] 

Recipient(s) of “carbon 

copies” of email message. 

BCC 

Mary Doe 

Recipient(s) of “blind carbon 
copies” of email message. 

EMAILSUBJECT 

Board Meeting Minutes 

Subject of an email message. 

CONVERSATIONIND 01C72AC4CB0FC3953C5FA8E149 
EX 389B522E FF595EF9FB 

Email thread identification 
created by the original email 
system 

INTMSGID 

<ooo8o5C2c7ib$75977050$cb 

8306di@MSN> 

Internet Message ID assigned 
to an email message by the 
outgoing mail server. 

NATIVEFILE 

NATIVE/ooi/EDCoooooo23.doc 

Relative path to the original 
native file for a record 

TEXTPATH 

TEXT/ooi/EDCoooooooi.txt 

Relative path to the 

associated text file for a 
record 























STATE OF MICHIGAN} 
67 TH DISTRICT COURT 


SEARCH WARRANT 


CASE NO. 2019 Flint Water Crisis 
POLICE AGENCY Department of Attorney 
General 

_ REPORT NO. 2019-FWCT _ 


TO THE SHERIFF OR ANY PEACE OFFICER: 


A. PERSON, PLACE, or THING to be searched is described as and located 
at: 

Department of Technology, Management and Budget (DTMB) 

Michigan Security Operations Center (MiSOC) 

7150 Harris Drive, Diamondale, MI 48821 

B. PROPERTY to be searched for and seized, if found, is specifically 
described as: 

1. “All 41 “Flint Water MiSOC Cases” identified on attached spreadsheet (Exhibit 
A). The term “Flint Water MiSOC Case” refers to a unique identifier assigned to 
each individual device assigned to DTMB digital forensic examiners for review 
and examination. All devices or the MiSOC image or extraction, the MiSOC 
report and documentation from the requesting state agency involved. MiSOC 
report to include the following forensic information: ITAM, Bit locker, picture of 
service tags/hard drives and any associated passwords. 

2. For any cell phones that are seized at the location listed in Paragraph A above, 
any and all content of cellular phones (including SIM cards and memoiy cards, if 
applicable): Including, but not limited to: contact lists; call history lists (including 
received, dialed, and missed calls); SMS/MMS (including, sent, received, and 
draft messages); pictures, videos, audio files; email; instant messaging; web 
HTML’s; Wi-Fi network information; GPS directions; calendars; notes; installed 
applications, usernames and passwords for said cellular telephones or 
applications (if applicable). 

3. For any desktop computers, laptop computers, or tablets, including peripherals 
and data storage media, that are seized at the location listed in Paragraph A 
above, any and all content of said computers and peripheral and data storage 
media including, but not limited to: electronically stored communications or 
messages; web page HTML’s, web searches, cookies, history, favorite sites; 
images; any user names and passwords, password files, test keys, encryption 
codes or other codes necessary to access the computers or applications to be 
searched or to convert any data file or information on the computers into a 
readable form. 

4. Any application software or other programs which are on the devices that could 
be used to facilitate the creation, transmission or storage of the described data 
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files, including but not limited to photo editing software, e-mail applications, 
word processing software, and/or software used to access the internet. Any 
passwords or password files necessary to gain access to the files, software, or 
applications which is on the devices. 

5. Electronic communications stored within the phone and storage devices as e- 
mail. Such information and/or communications that may be in the form of 
electronic communications (such as e-mail) residing on any media (e.g., 
magnetic, optical or digital media). That information may include electronic 
communications held or maintained in electronic storage by an electronic 
communication service or remote computing service, as those services are 
defined within 18 U.S.C. 2703. These communications are referred to herein as 
“stored communications”. These communications related to this case stored in 
the suspect’s computer or other electronic devices as e-mail. That federal law, 
which is part of the Electronic Communications Privacy Act, allows interception 
of such electronic communication pursuant to a search warrant. 


IN THE NAME OF THE PEOPLE OF THE STATE OF MICHIGAN: I have found that probable 
cause exists and you are commanded to make the search and seize the described property. Leave a 
copy of this warrant with attached tabulation (a written inventory) of all property taken with the 
person from whom the property was taken or at the premises. You are further commanded to 
promptly return this warrant and tabulation to the Court. 
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FLINT WATER MISOC CASES 


[MiSOC CASE # (AGENCY 

Definite (D)/Possible (P) 

1601-0078 

DEQ 

D 

1603-0226 

DEO. 

P 

1603-0296 

MDHHS 

P 

1603-0322 

MDHHS 

P 

1605-0439 

MDHHS 

D 

1605-0442 

DEQ 

D 

1605-0475 

MDHHS 

P 

1605-0478 

Gov's Ofc. 

D 

1607-0639 

Gov's Ofc. 

P 

1608-0757 

MDHHS 

D 

1609-0804 

DEQ 

D 

1609-0837 

MDHHS 

D 

1609-0842 

MDHHS 

D 

1611-1051 

MDHHS 

D 

1701-0028 

MDHHS 

D 

1701-0048 

DEQ 

D 

1701-0056 

MDHHS 

D 

1701-0057 

MDHHS 

D 

1701-0084 

MDHHS 

P 

1701-0121 

Gov's Ofc. 

P 

1703-0222 

DEQ 

P 

1703-0245 

DEQ 

P 

1707-0715 

MSHDA 

P 

1802-0154 

DEQ 

P 

1803-0223 

MDHHS 

D 

1805-0505 

MDHHS 

D 

1806-0545 

DEQ 

D 

1806-0546 

MDHHS 

D 

1806-0629 

DEQ 

D 

1809-0781 

MDHHS 

D 

1810-0885 

MDE 

D 

1810-0893 

Gov's Ofc. 

D 

1810-0909 

MDHHS 

D 

1810-0919 

MDHHS 

D 

1811-0968 

MDHHS 

D 

1902-0104 

MDHHS 

D 

1902-0148 

MDHHS 

D 

1903-0234 

MDHHS 

D 
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STATE OF MICHIGAN 

SEARCH WARRANT 

CASE NO. 2019 Flint Water Crisis 

67TH DISTRICT COURT 


POLICE AGENCY Department of Attorney 


General 



REPORT NO. 2019-FWCT 


TO THE SHERIFF OR ANY PEACE OFFICER: 


A. PERSON, PLACE, or THING to be searched is described as and located 
at: 

The Department of Attorney General, State Operations Division, 525 West 
Ottawa, G. Mennen Williams Bldg., Lansing, MI 48909 

R. PROPERTY to be searched for and seized, if found, is specifically 
described as: 

1. See “Exhibit A” to include logs and/or reports identifying relevant passwords, bit 
locker codes, usernames, user ids, iCloud/iTunes logins. 

2. For any cell phones that are seized at the location listed in Paragraph A above, 
any and atl content of cellular phones (including SIM cards and memory cards, if 
applicable): Including, but not limited to: contact lists; call histoiy lists (including 
received, dialed, and missed calls); SMS/MMS (including, sent, received, and 
draft messages); pictures, videos, audio files; email; instant messaging; web 
HTML’s; Wi-Fi network information; GPS directions; calendars; notes; installed 
applications, usernames and passwords for said cellular telephones or 
applications (if applicable). 

3. For any desktop computers, laptop computers, or tablets, including peripherals 
and data storage media, that are seized at the location listed in Paragraph A 
above, any and all content of said computers and peripheral and data storage 
media including, but not limited to: electronically stored communications or 
messages; web page HTML’s, web searches, cookies, histoiy, favorite sites; 
images; any user names and passwords, password files, test keys, encryption 
codes or other codes necessary to access the computers or applications to be 
searched or to convert any data file or information on the computers into a 
readable form. 

4. Any application software or other programs which are on the devices that could 
be used to facilitate the creation, transmission or storage of the described data 
files, including but not limited to photo editing software, e-mail applications, 
word processing software, and/or software used to access the internet. Any 
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passwords or password files necessary to gain access to the files, software, or 
applications which is on the devices. 

5. Electronic communications stored within the phone and storage devices as e- 
mail. Such information and/or communications that may be in the form of 
electronic communications (such as e-mail) residing on any media (e.g., 
magnetic, optical or digital media). That information may include electronic 
communications held or maintained in electronic storage by an electronic 
communication service or remote computing service, as those services are 
defined within 18 U.S.C. 2703. These communications are referred to herein as 
“stored communications”. These communications related to this case stored in 
the suspect’s computer or other electronic devices as e-mail. That federal law, 
which is part of the Electronic Communications Privacy Act, allows interception 
of such electronic communication pursuant to a search warrant. 


I 

I 

, 

IN THE NAME OF TILE PEOPLE OF THE STATE OF MICHIGAN: I have found that probable 
cause exists and you are commanded to make the search and seize the described property. Leave a 
copy of this warrant with attached tabulation (a written inventory) of all property taken with the 
person from whom the property was taken or at the premises. You are further commanded <0 
promptly return this warrant and tabulation to the Court. 
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iPhone 6 extraction J " ^ 1/11/2017 Successful extraction. According to WNJ. 

the responsive, ncn-pnviloged information 

. was produced to OSC. Original data held by 

eDiscovery vender, DAG does not have a 
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